CVE-2026-19896

LOW 3.7

mangroup dtale Flask Session Cookie app.py build_secret_key random values

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CWE	CWE-330 CWE-310
Vendor	mangroup
Product	dtale
Published	Aug 15, 2026

Stay Ahead of the Next One

Get instant alerts for mangroup dtale

Be the first to know when new low vulnerabilities affecting mangroup dtale are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mangroup / dtale

3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20 3.21 3.22.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/390086 vuldb.com: https://vuldb.com/vuln/390086/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19896 vuldb.com: https://vuldb.com/submit/870672 github.com: https://github.com/man-group/dtale/issues/960 github.com: https://github.com/man-group/dtale/pull/963

Credits

🔍 ZAST.AI (VulDB User) VulDB CNA Team